In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow (CVE-2022-27255). This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data. Realtek’s advisory from March 2022 traces it to unchecked strcpy calls into a fixed buffer, reachable through the WAN interface, and credits Faraday’s Security Research team. Faraday’s repository for their DEF CON 30 talk contains a proof of concept, Ghidra scripts and a firmware analysis tool, plus a list of affected routers and range extenders.
